fix: Webhook verifier unbounded IO read (#56)

PaddleHQ · Dec 19, 2024 · 3862570 · 3862570
1 parent c4967a5
commit 3862570
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/webhook_verifier.go b/webhook_verifier.go
@@ -51,6 +51,10 @@ func (wv *WebhookVerifier) Verify(req *http.Request) (bool, error) {
 	ts := matches[0][1]
 	h1 := matches[0][2]
 
+	const maxBodySize = 2 << 20 // 2 MB
+
+	req.Body = http.MaxBytesReader(nil, req.Body, maxBodySize)
+
 	body, err := io.ReadAll(req.Body)
 	if err != nil {
 		return false, err